NetWalker ransomware operation disrupted by US and Bulgarian authorities

This week, law enforcement agencies from Bulgaria and the US have disrupted the infrastructure of NetWalker, one of 2020’s most active ransomware cliques.

Bulgarian officials seized a server used to host dark web portals for the NetWalker ring, with officials in the US indicting a Canadian national who ostensibly made at least $27.6 million from blighting companies with the NetWalker ransomware.

The held servers were used to host pages where victims of NetWalker attacks were redirected to connect with the hackers and negotiate ransom demands.

Particulars about the Canadian national indicted today are not yet obtainable beyond his name and residence — Sebastien Vachon-Desjardins, of Gatineau.

Vachon-Desjardins is currently thought to be an “affiliate,” an individual who lent the ransomware code from the NetWalker creator.

This type of business is called Ransomware-as-a-Service, or RaaS, and is a common setup employed by many ransomware gangs today.

US authorities suggest that NetWalker has affected at least 305 victims from 27 different countries, including 203 in the US.